Skip to content

Repository navigation

fix(runtime): isolate JVM and Gradle verification homes #793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efraespada merged 4 commits into from
Oct 29, 2026
Merged

fix(runtime): isolate JVM and Gradle verification homes #793

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
54543d0
bugfix-775-private-verification-home-does-not-redirect-jvmgradle-acco…
efraespada Oct 29, 2026
4c30600
bugfix-775-private-verification-home-does-not-redirect-jvmgradle-acco…
efraespada Oct 29, 2026
e9a2370
bugfix-775-private-verification-home-does-not-redirect-jvmgradle-acco…
efraespada Oct 29, 2026
a9d7de1
bugfix-775-private-verification-home-does-not-redirect-jvmgradle-acco…
efraespada Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .copilot/AGENT_GUIDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ Never expose credentials, tokens, private keys, or other secrets in issues, comm

The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job.

Declare reviewed version prefixes in `.copilot/verification-prerequisites.json` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use `actions/setup-java`; `JAVA_HOME` and `PATH` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).
Declare reviewed version prefixes in `.copilot/verification-prerequisites.json` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use `actions/setup-java`; `JAVA_HOME` and `PATH` survive isolation. Repository verification derives `JDK_JAVA_OPTIONS` for its private JVM user.home and `GRADLE_USER_HOME` inside the same fresh profile; inherited tool options, account caches and agent credentials remain excluded. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).

The optional repository-owned composite action prepares each candidate before verification. Setup creates .github/actions/copilot-verification-setup/action.yml only if missing and preserves an existing consumer action and its assets. The shared terminal/web assistant offers explicit activation, disabled by default. Customize the generated failing placeholder before enabling; setup generation and installer PRs do not prove runtime readiness. Review `.github/actions/copilot-verification-setup/action.yml` and its assets onto trusted main, update generated workflows, then enable `VERIFICATION_SETUP=true` (Action input `verification-setup`, disabled by default). GitHub Actions executes the trusted snapshot before each command with a fresh private HOME; candidate changes cannot replace it. Native post steps finish before profile cleanup. Setup failure blocks verification and commit/push. The local CLI cannot execute composite actions and fails closed when opted in. Read [repository-owned setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-owned-setup).

Expand Down
2 changes: 1 addition & 1 deletion .copilot/setup-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
},
".copilot/AGENT_GUIDE.md": {
"role": "guide",
"sha256": "c3bd0df4bfdcbba2a007b1596a93480a3bb3145a6285e0a91809f3a93c3fbcd0"
"sha256": "2e9f977122b9fcb1d6cf12bb6fac4bb500691797f425c2acd802ede354a06075"
},
".copilot/repository-profile.json": {
"role": "profile",
Expand Down
40 changes: 40 additions & 0 deletions .github/workflows/copilot_comment_runtime.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,8 @@ jobs:
LOCALAPPDATA: ${{ steps.copilot.outputs.verification-localappdata }}
PATH: ${{ steps.copilot.outputs.verification-path }}
JAVA_HOME: ${{ steps.copilot.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.copilot.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.copilot.outputs.verification-gradle_user_home }}
TMP: ${{ steps.copilot.outputs.verification-tmp }}
TEMP: ${{ steps.copilot.outputs.verification-temp }}
TMPDIR: ${{ steps.copilot.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -205,6 +207,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_1.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_1.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_1.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_1.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_1.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_1.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_1.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_1.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -233,6 +237,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_2.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_2.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_2.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_2.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_2.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_2.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_2.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_2.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -261,6 +267,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_3.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_3.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_3.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_3.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_3.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_3.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_3.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_3.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -289,6 +297,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_4.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_4.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_4.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_4.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_4.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_4.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_4.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_4.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -317,6 +327,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_5.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_5.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_5.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_5.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_5.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_5.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_5.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_5.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -345,6 +357,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_6.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_6.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_6.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_6.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_6.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_6.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_6.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_6.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -373,6 +387,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_7.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_7.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_7.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_7.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_7.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_7.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_7.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_7.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -401,6 +417,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_8.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_8.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_8.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_8.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_8.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_8.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_8.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_8.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -429,6 +447,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_9.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_9.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_9.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_9.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_9.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_9.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_9.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_9.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -457,6 +477,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_10.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_10.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_10.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_10.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_10.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_10.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_10.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_10.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -485,6 +507,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_11.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_11.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_11.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_11.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_11.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_11.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_11.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_11.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -513,6 +537,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_12.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_12.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_12.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_12.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_12.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_12.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_12.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_12.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -541,6 +567,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_13.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_13.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_13.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_13.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_13.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_13.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_13.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_13.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -569,6 +597,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_14.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_14.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_14.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_14.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_14.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_14.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_14.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_14.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -597,6 +627,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_15.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_15.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_15.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_15.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_15.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_15.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_15.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_15.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -625,6 +657,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_16.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_16.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_16.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_16.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_16.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_16.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_16.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_16.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -653,6 +687,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_17.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_17.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_17.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_17.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_17.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_17.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_17.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_17.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -681,6 +717,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_18.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_18.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_18.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_18.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_18.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_18.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_18.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_18.outputs.verification-tmpdir }}
Expand Down Expand Up @@ -709,6 +747,8 @@ jobs:
LOCALAPPDATA: ${{ steps.verification_continue_19.outputs.verification-localappdata }}
PATH: ${{ steps.verification_continue_19.outputs.verification-path }}
JAVA_HOME: ${{ steps.verification_continue_19.outputs.verification-java_home }}
JDK_JAVA_OPTIONS: ${{ steps.verification_continue_19.outputs.verification-jdk_java_options }}
GRADLE_USER_HOME: ${{ steps.verification_continue_19.outputs.verification-gradle_user_home }}
TMP: ${{ steps.verification_continue_19.outputs.verification-tmp }}
TEMP: ${{ steps.verification_continue_19.outputs.verification-temp }}
TMPDIR: ${{ steps.verification_continue_19.outputs.verification-tmpdir }}
Expand Down
Loading
Loading